Enable and Configure Soft Card Authentication on a Windows HPC Cluster

Applies To: Microsoft HPC Pack 2012, Microsoft HPC Pack 2012 R2

Starting in HPC Pack 2008 R2 with Service Pack 2, if your organization uses smart card authentication, you can enable cluster users to use their smart card credentials to generate a soft card certificate that can be selected as credentials on the cluster. This topic describes the requirements and steps for configuring soft card authentication on a Windows HPC cluster.

Requirements to enable HPC soft card authentication

Active Directory environment

• The Active Directory and Active Directory domain controllers must be configured for smart card authentication.

• The Active Directory domain controller must be running at least Windows Server 2008 R2.

• The computer on which the Certification Authority role service of Active Directory Certificate Services is installed must be running at least Windows Server 2008 R2.

For more information about installing and managing the CA role service, see Active Directory Certificate Services.

Install the HPC soft card key storage provider

To enable soft card authentication when submitting jobs to a HPC Pack cluster, you must install the HPC soft card key storage provider (KSP) on the following computers:

• The head node of your cluster

• The compute nodes, workstation nodes, and unmanaged server nodes (if supported) of your cluster

To install the KSP, you must separately run the version of the installation program that is appropriate for the operating system on each computer: HpcKsp_x64.msi or HpcKsp_x86.msi. The installation programs are included in the installation files for supported versions of HPC Pack that are available on the Microsoft Download Center or in installation media.

You can copy the installers to a shared folder that all on-premises nodes can access and then use the clusrun command to install the KSP on all nodes. For example, you can copy the installers to the ccpspooldir share on the head node (\\<headnode>\ccpspooldir) and then run the following command (for 64-bit computers):

clusrun msiexec  /passive /I  \\<headnode>\ccpspooldir\hpcksp_x64.msi

The following table shows the operating systems on which you can install the HPC soft card KSP for HPC Pack.

Create a certificate template

Before enabling HPC soft card authentication on the cluster, work with your certification authority (CA) or PKI administrator to choose or create a certificate template that should be used when generating a soft card for the cluster. Ensure that the validity period in the template is long enough to accommodate the job lifecycle. Optionally, the template can have an associated access control list that defines who can use the certificate template.

The CA role service includes several default certificate templates. The CA administrator can create an HPC soft card template by copying and then modifying the default Smart Card Logon template in the Certificate Templates Console as follows:

1. In Extensions, in Application Policies, remove Smart Card Logon.

2. In Request Handling, click Allow private key to be exported.

3. In Security, specify the users who can enroll (optional).

4. Ensure that the validity period in the template is long enough to accommodate the job lifecycle.

For more information, see Creating Certificate Templates.

Configure HPC soft card authentication on the cluster

To configure HPC soft card authentication on the cluster, set the cluster properties in the following table. To set the properties, run the cluscfg command or the Set-HpcClusterProperty Windows HPC PowerShell cmdlet.

For example, use the following procedure to allow soft card authentication on the cluster, specify a certificate template, and configure a warning period for soft cards that are nearing their expiration date.

To configure soft card authentication on the cluster

1. To allow soft card authentication on the cluster, start HPC PowerShell as an Administrator and type:

   Set-HpcClusterProperty –HpcSoftCard:Allowed

   Or, at an elevated command prompt, type:

   cluscfg setparams HpcSoftCard=Allowed

2. To specify the certificate template (for example, MySoftCardtemplate) that should be used to generate a soft card credential, start HPC PowerShell as an Administrator and type:

   Set-HpcClusterProperty –HpcSoftCardTemplate MySoftCardtemplate

   Or, at an elevated command prompt, type:

   cluscfg setparams HpcSoftCardTemplate=MySoftCardtemplate

3. To configure a 3 day warning period for soft cards that are nearing their expiration date, start HPC PowerShell as an Administrator and type:

   Set-HpcClusterProperty –SoftCardExpirationWarning 3

   Or, at an elevated command prompt, type:

   cluscfg setparams SoftCardExpirationWarning=3

Generate HPC soft card credentials

You can use HPC soft card credentials to submit jobs, run SOA sessions, and run diagnostic tests. Use the following commands to manage your HPC soft card credentials, or to set SOA or diagnostic credentials.

The following procedure shows how a cluster user can generate an HPC soft card certificate by using the hpccred command or the New-HpcSoftcard cmdlet. The commands generate a public key pair and obtain the certificate from the CA that is configured for your Active Directory domain. The certificate is based on the template that is specified by the HpcSoftCardTemplate cluster property. The certificate is placed in your personal certificate store on your computer.

To generate a new HPC soft card certificate

1. Log on to the computer with your smart card.

2. Use one of the following methods to generate an HPC soft card.

   Start HPC PowerShell as an Administrator and type:

   New-HpcSoftCard

   Or, at a command prompt, type:

   hpccred createcert

Submit a job with HPC soft card credentials

To submit a job by using the HPC soft card credentials

1. Use one of the following methods to delete any previously cached credentials.

   Start HPC PowerShell as an Administrator and type:

   Remove-hpcJobCredential

   Or, at a command prompt, type:

   hpccred delcreds

2. Submit a job. For example, you can submit a simple test job by using one of the following methods.

   Start HPC PowerShell as an Administrator and type:

   New-HpcJob | Add-hpcTask –Command "echo hello" | Submit-HpcJob

   Or, at a command prompt, type:

   job submit echo hello

3. When prompted, select which credentials to use.

Additional considerations

• If you are using HPC soft card credentials, you cannot run jobs as a different user.

• HPC soft card authentication is not supported for cluster deployment operations (for example, unattended installations and joining compute nodes to the domain).

See also

• cluscfg

• Set-HpcClusterProperty

• Active Directory Certificate Services